Why can't someone create a valid digital signature without knowing your private key?

I understand from the following two posts that private keys are not displayed by the sender when getting their transaction validated by the bitcoin miners:

What happens to Private Key on Payment

How can transactions be verified without the private key?

Instead a digital signature is provided that is based on the Private Key, and, as far as I understand, that digital signature is verifiable when "compared" to the Public Key.

Why then can't someone generate a verifiable digital signature using only someone else's public key?

Or put another way, quoting an answer from the first post listed above:

"A valid signature cannot be created without access to the private key" - why not?

Bitcoin uses something called the Elliptic Curve Digital Signature Algorithm (ECDSA) for signing and verifying transactions. Read the linked Wikipedia article for exact process of how ECDSA works. If you understand how the modulo operator works, it should make sense as to why you can't make a signature without the private key.

It's kind of hard for me to explain this as it does rely on some complex mathematics, but I will try.

To produce a valid ECDSA signature, you need the private key, which is a large integer. It is explicitly used in the signature creation algorithm, but the public key is not. Furthermore, the public key is not an integer like the private key; rather it is a point on an elliptic curve. So even if you know the public key, you can't create a signature with it because it is not the private key and you can't recover the private key from the public key.

The private key cannot be recovered from the public key because of a problem called the Elliptic Curve Discrete Logarithm Problem. From Wikipedia:

it is assumed that finding the discrete logarithm of a random elliptic curve element with respect to a publicly known base point is infeasible: this is the "elliptic curve discrete logarithm problem" (ECDLP).

The private key is the discrete logarithm. Although this is an assumption, it has been shown in practice that ECDLP is a hard problem, i.e. it is hard to find the discrete log given a base point and public key point. So you can't get the private key that is required in ECDSA to produce the signature.

• thanks this definitely helps, whilst I can't claim to fully understand the answer, just knowing that I didn't have some simple flaw in my understanding of how bitcoin works is useful. Nov 9 '17 at 10:05

"A valid signature cannot be created without access to the private key" - why not?

In few words: because there is no known algorithm today to do it.

This is a feature of digital signatures from public-key cryptography. It's probably out of the scope of this site to explain how cryptography works. Maybe https://crypto.stackexchange.com/ would be a better place to ask.